PT-2026-23458 · Unknown · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30793

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A Cross-Site Request Forgery (CSRF) issue exists in RustDesk Client on Windows, MacOS, Linux, iOS, and Android. This flaw potentially allows for privilege escalation. The issue is related to the Flutter URI scheme handler and FFI bridge modules, specifically within the files flutter/lib/common.Dart and src/flutter ffi.Rs, and the routines URI handler for rustdesk://password() and bind.MainSetPermanentPassword().

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

LPE

Improper Authorization

CSRF

Weakness Enumeration

CWE-285

CWE-352

Related Identifiers

CVE-2026-30793

Affected Products

Rustdesk Client

References · 8

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30793 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30793 · Vendor Advisory
• https://github.com/rustdesk/rustdesk · Note
• https://github.com/rustdesk/hbb_common · Note
• https://vulsec.org · Note
• https://t.me/CVEtracker/46452 · Telegram Post
• https://twitter.com/CVEnew/status/2029654739915325688 · Twitter Post